Bug 1418584 (CVE-2015-8981, CVE-2017-5852, CVE-2017-5853, CVE-2017-5854, CVE-2017-5855, CVE-2017-5886, CVE-2017-6840, CVE-2017-6841, CVE-2017-6842, CVE-2017-6843, CVE-2017-6844, CVE-2017-6845, CVE-2017-6846, CVE-2017-6847, CVE-2017-6848, CVE-2017-6849)

Summary:	CVE-2017-5852 CVE-2017-5853 CVE-2017-5854 CVE-2015-8981 CVE-2017-5855 CVE-2017-5886 podofo: Multiple security vulnerabilities
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dan, manisandro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:06:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1418585, 1418586
Bug Blocks:

Description Andrej Nemec 2017-02-02 09:22:32 UTC

Multiple security vulnerabilities in podofo were reported to the oss-security list and received CVEs.

CVE-2015-8981 - Heap overflow in the function ReadXRefSubsection

https://sourceforge.net/p/podofo/mailman/message/34205419/
https://sourceforge.net/p/podofo/code/1672

CVE-2017-5852 - Infinite loop in PoDoFo::PdfPage::GetInheritedKeyFromObject

http://seclists.org/oss-sec/2017/q1/285

CVE-2017-5853 - Signed integer overflow in PdfParser.cpp

http://seclists.org/oss-sec/2017/q1/286

CVE-2017-5854 - NULL pointer dereference in PdfOutputStream.cpp

http://seclists.org/oss-sec/2017/q1/287

CVE-2017-5855 - NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection

http://seclists.org/oss-sec/2017/q1/288

No CVE yet - NULL pointer dereference in PdfInfo::GuessFormat

http://seclists.org/oss-sec/2017/q1/267

Comment 1 Andrej Nemec 2017-02-02 09:23:12 UTC

Created podofo tracking bugs for this issue:

Affects: epel-all [bug 1418585]
Affects: fedora-all [bug 1418586]

Comment 2 Andrej Nemec 2017-02-07 09:10:52 UTC

One more issue was reported:

CVE-2017-5886 - Heap-based buffer overflow in PoDoFo::PdfTokenizer::GetNextToken

http://seclists.org/oss-sec/2017/q1/301

Comment 3 Andrej Nemec 2017-03-22 09:10:30 UTC

Multiple new issues were reported in podofo:

CVE-2017-6843 - Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. 

CVE-2017-6844 - Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. 

CVE-2017-6845 - The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. 

CVE-2017-6846 - The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. 

CVE-2017-6847 - The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. 

CVE-2017-6848 - The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. 

CVE-2017-6849 - The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.

Comment 4 Andrej Nemec 2017-03-22 09:16:28 UTC

CVE-2017-6840 - The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (invalid read) via a crafted file. 

CVE-2017-6841 - The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file. 

CVE-2017-6842 - The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.

Comment 5 Product Security DevOps Team 2019-06-08 03:06:49 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.